ADVISORIES

• CVE-2022-25648 (NVD)
• GHSA-69p6-wvmq-27gg
• Vendor Advisory

GEM

git

SEVERITY

CVSS v3.x: 9.8 (Critical)

PATCHED VERSIONS

• >= 1.11.0

DESCRIPTION

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = ‘origin’, opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

RELATED

• https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0